199 lines
6.4 KiB
PHP
199 lines
6.4 KiB
PHP
<?php
|
|
|
|
require('config.php');
|
|
|
|
$params = split("/", $_SERVER["PATH_INFO"], 3);
|
|
$realm = $params[1];
|
|
$cmd = $params[2];
|
|
$method = $_SERVER["REQUEST_METHOD"];
|
|
|
|
unset($user);
|
|
unset($rowid);
|
|
|
|
if (!empty($_SERVER['PHP_AUTH_DIGEST'])) {
|
|
$needed = array('nonce'=>1, 'nc'=>1, 'cnonce'=>1, 'qop'=>1, 'username'=>1,
|
|
'uri'=>1, 'response'=>1);
|
|
$data = array();
|
|
$keys = implode('|', array_keys($needed));
|
|
preg_match_all('@(' . $keys . ')=(?:([\'"])([^\2]+?)\2|([^\s,]+))@',
|
|
$_SERVER['PHP_AUTH_DIGEST'], $matches, PREG_SET_ORDER);
|
|
foreach ($matches as $m) {
|
|
$data[$m[1]] = $m[3] ? $m[3] : $m[4];
|
|
unset($needed[$m[1]]);
|
|
}
|
|
if ($needed) {
|
|
error_log("EST: Missing auth parameter");
|
|
die('Authentication failed');
|
|
}
|
|
$user = $data['username'];
|
|
if (strlen($user) < 1) {
|
|
error_log("EST: Empty username");
|
|
die('Authentication failed');
|
|
}
|
|
|
|
$db = new PDO($osu_db);
|
|
if (!$db) {
|
|
error_log("EST: Could not access database");
|
|
die("Could not access database");
|
|
}
|
|
|
|
$sql = "SELECT rowid,password,operation FROM sessions " .
|
|
"WHERE user='$user' AND realm='$realm'";
|
|
$q = $db->query($sql);
|
|
if (!$q) {
|
|
error_log("EST: Session not found for user=$user realm=$realm");
|
|
die("Session not found");
|
|
}
|
|
$row = $q->fetch();
|
|
if (!$row) {
|
|
error_log("EST: Session fetch failed for user=$user realm=$realm");
|
|
die('Session not found');
|
|
}
|
|
$rowid = $row['rowid'];
|
|
|
|
$oper = $row['operation'];
|
|
if ($oper != '5') {
|
|
error_log("EST: Unexpected operation $oper for user=$user realm=$realm");
|
|
die("Session not found");
|
|
}
|
|
$pw = $row['password'];
|
|
if (strlen($pw) < 1) {
|
|
error_log("EST: Empty password for user=$user realm=$realm");
|
|
die('Authentication failed');
|
|
}
|
|
|
|
$A1 = md5($user . ':' . $realm . ':' . $pw);
|
|
$A2 = md5($method . ':' . $data['uri']);
|
|
$resp = md5($A1 . ':' . $data['nonce'] . ':' . $data['nc'] . ':' .
|
|
$data['cnonce'] . ':' . $data['qop'] . ':' . $A2);
|
|
if ($data['response'] != $resp) {
|
|
error_log("EST: Incorrect authentication response for user=$user realm=$realm");
|
|
die('Authentication failed');
|
|
}
|
|
}
|
|
|
|
|
|
if ($method == "GET" && $cmd == "cacerts") {
|
|
$fname = "$osu_root/est/$realm-cacerts.pkcs7";
|
|
if (!file_exists($fname)) {
|
|
error_log("EST: cacerts - unknown realm $realm");
|
|
die("Unknown realm");
|
|
}
|
|
|
|
header("Content-Transfer-Encoding: base64");
|
|
header("Content-Type: application/pkcs7-mime");
|
|
|
|
$data = file_get_contents($fname);
|
|
echo wordwrap(base64_encode($data), 72, "\n", true);
|
|
echo "\n";
|
|
error_log("EST: cacerts");
|
|
} else if ($method == "GET" && $cmd == "csrattrs") {
|
|
header("Content-Transfer-Encoding: base64");
|
|
header("Content-Type: application/csrattrs");
|
|
readfile("$osu_root/est/est-attrs.b64");
|
|
error_log("EST: csrattrs");
|
|
} else if ($method == "POST" && $cmd == "simpleenroll") {
|
|
if (!isset($user) || strlen($user) == 0) {
|
|
header('HTTP/1.1 401 Unauthorized');
|
|
header('WWW-Authenticate: Digest realm="'.$realm.
|
|
'",qop="auth",nonce="'.uniqid().'",opaque="'.md5($realm).'"');
|
|
error_log("EST: simpleenroll - require authentication");
|
|
die('Authentication required');
|
|
}
|
|
if (!isset($_SERVER["CONTENT_TYPE"])) {
|
|
error_log("EST: simpleenroll without Content-Type");
|
|
die("Missing Content-Type");
|
|
}
|
|
if (!stristr($_SERVER["CONTENT_TYPE"], "application/pkcs10")) {
|
|
error_log("EST: simpleenroll - unexpected Content-Type: " .
|
|
$_SERVER["CONTENT_TYPE"]);
|
|
die("Unexpected Content-Type");
|
|
}
|
|
|
|
$data = file_get_contents("php://input");
|
|
error_log("EST: simpleenroll - POST data from php://input: " . $data);
|
|
$req = base64_decode($data);
|
|
if ($req == FALSE) {
|
|
error_log("EST: simpleenroll - Invalid base64-encoded PKCS#10 data");
|
|
die("Invalid base64-encoded PKCS#10 data");
|
|
}
|
|
$cadir = "$osu_root/est";
|
|
$reqfile = "$cadir/tmp/cert-req.pkcs10";
|
|
$f = fopen($reqfile, "wb");
|
|
fwrite($f, $req);
|
|
fclose($f);
|
|
|
|
$req_pem = "$reqfile.pem";
|
|
if (file_exists($req_pem))
|
|
unlink($req_pem);
|
|
exec("openssl req -in $reqfile -inform DER -out $req_pem -outform PEM");
|
|
if (!file_exists($req_pem)) {
|
|
error_log("EST: simpleenroll - Failed to parse certificate request");
|
|
die("Failed to parse certificate request");
|
|
}
|
|
|
|
/* FIX: validate request and add HS 2.0 extensions to cert */
|
|
$cert_pem = "$cadir/tmp/req-signed.pem";
|
|
if (file_exists($cert_pem))
|
|
unlink($cert_pem);
|
|
exec("openssl x509 -req -in $req_pem -CAkey $cadir/cakey.pem -out $cert_pem -CA $cadir/cacert.pem -CAserial $cadir/serial -days 365 -text");
|
|
if (!file_exists($cert_pem)) {
|
|
error_log("EST: simpleenroll - Failed to sign certificate");
|
|
die("Failed to sign certificate");
|
|
}
|
|
|
|
$cert = file_get_contents($cert_pem);
|
|
$handle = popen("openssl x509 -in $cert_pem -serial -noout", "r");
|
|
$serial = fread($handle, 200);
|
|
pclose($handle);
|
|
$pattern = "/serial=(?P<snhex>[0-9a-fA-F:]*)/m";
|
|
preg_match($pattern, $serial, $matches);
|
|
if (!isset($matches['snhex']) || strlen($matches['snhex']) < 1) {
|
|
error_log("EST: simpleenroll - Could not get serial number");
|
|
die("Could not get serial number");
|
|
}
|
|
$sn = str_replace(":", "", strtoupper($matches['snhex']));
|
|
|
|
$user = "cert-$sn";
|
|
error_log("EST: user = $user");
|
|
|
|
$cert_der = "$cadir/tmp/req-signed.der";
|
|
if (file_exists($cert_der))
|
|
unlink($cert_der);
|
|
exec("openssl x509 -in $cert_pem -inform PEM -out $cert_der -outform DER");
|
|
if (!file_exists($cert_der)) {
|
|
error_log("EST: simpleenroll - Failed to convert certificate");
|
|
die("Failed to convert certificate");
|
|
}
|
|
$der = file_get_contents($cert_der);
|
|
$fingerprint = hash("sha256", $der);
|
|
|
|
$pkcs7 = "$cadir/tmp/est-client.pkcs7";
|
|
if (file_exists($pkcs7))
|
|
unlink($pkcs7);
|
|
exec("openssl crl2pkcs7 -nocrl -certfile $cert_pem -out $pkcs7 -outform DER");
|
|
if (!file_exists($pkcs7)) {
|
|
error_log("EST: simpleenroll - Failed to prepare PKCS#7 file");
|
|
die("Failed to prepare PKCS#7 file");
|
|
}
|
|
|
|
if (!$db->exec("UPDATE sessions SET user='$user', cert='$fingerprint', cert_pem='$cert' WHERE rowid=$rowid")) {
|
|
error_log("EST: simpleenroll - Failed to update session database");
|
|
die("Failed to update session database");
|
|
}
|
|
|
|
header("Content-Transfer-Encoding: base64");
|
|
header("Content-Type: application/pkcs7-mime");
|
|
|
|
$data = file_get_contents($pkcs7);
|
|
$resp = wordwrap(base64_encode($data), 72, "\n", true);
|
|
echo $resp . "\n";
|
|
error_log("EST: simpleenroll - PKCS#7 response: " . $resp);
|
|
} else {
|
|
header("HTTP/1.0 404 Not Found");
|
|
error_log("EST: Unexpected method or path");
|
|
die("Unexpected method or path");
|
|
}
|
|
|
|
?>
|